Skip to content

Commit d757b66

Browse files
alexeykazakovalexeykazakov
authored
Add tier for -claw namespace (#1265)
* Add tier for -claw namespace * Refactor manifests
1 parent f9148fc commit d757b66

8 files changed

Lines changed: 335 additions & 0 deletions

File tree

‎deploy/templates/nstemplatetiers/base/ns_dev.yaml‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -76,6 +76,15 @@ objects:
7676
defaultRequest:
7777
cpu: 10m
7878
memory: 64Mi
79+
- apiVersion: v1
80+
kind: ResourceQuota
81+
metadata:
82+
name: compute-spacerequests
83+
namespace: ${SPACE_NAME}-dev
84+
spec:
85+
hard:
86+
count/spacerequests.toolchain.dev.openshift.com: "1"
87+
7988
- apiVersion: networking.k8s.io/v1
8089
kind: NetworkPolicy
8190
metadata:

‎deploy/templates/nstemplatetiers/base/ns_stage.yaml‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -76,6 +76,15 @@ objects:
7676
defaultRequest:
7777
cpu: 10m
7878
memory: 64Mi
79+
- apiVersion: v1
80+
kind: ResourceQuota
81+
metadata:
82+
name: compute-spacerequests
83+
namespace: ${SPACE_NAME}-stage
84+
spec:
85+
hard:
86+
count/spacerequests.toolchain.dev.openshift.com: "1"
87+
7988
- apiVersion: networking.k8s.io/v1
8089
kind: NetworkPolicy
8190
metadata:

‎deploy/templates/nstemplatetiers/base1ns/ns_dev.yaml‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -120,6 +120,15 @@ objects:
120120
cpu: 10m
121121
memory: 64Mi
122122

123+
- apiVersion: v1
124+
kind: ResourceQuota
125+
metadata:
126+
name: compute-spacerequests
127+
namespace: ${SPACE_NAME}-dev
128+
spec:
129+
hard:
130+
count/spacerequests.toolchain.dev.openshift.com: "1"
131+
123132
- apiVersion: networking.k8s.io/v1
124133
kind: NetworkPolicy
125134
metadata:

‎deploy/templates/nstemplatetiers/claw/cluster.yaml‎

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
apiVersion: template.openshift.io/v1
2+
kind: Template
3+
metadata:
4+
name: claw-cluster-resources
5+
objects:
6+
- apiVersion: quota.openshift.io/v1
7+
kind: ClusterResourceQuota
8+
metadata:
9+
name: for-${SPACE_NAME}-claw
10+
spec:
11+
quota:
12+
hard:
13+
count/deployments.apps: "5"
14+
count/pods: "10"
15+
count/routes.route.openshift.io: "3"
16+
count/services: "5"
17+
count/secrets: "50"
18+
count/configmaps: "10"
19+
selector:
20+
annotations: null
21+
labels:
22+
matchLabels:
23+
toolchain.dev.openshift.com/space: ${SPACE_NAME}
24+
- apiVersion: toolchain.dev.openshift.com/v1alpha1
25+
kind: Idler
26+
metadata:
27+
name: ${SPACE_NAME}-claw
28+
spec:
29+
timeoutSeconds: ${{IDLER_TIMEOUT_SECONDS}}
30+
parameters:
31+
- name: SPACE_NAME
32+
required: true
33+
- name: IDLER_TIMEOUT_SECONDS
34+
# 12 hours
35+
value: "43200"

‎deploy/templates/nstemplatetiers/claw/ns_claw.yaml‎

Lines changed: 171 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,171 @@
1+
apiVersion: template.openshift.io/v1
2+
kind: Template
3+
metadata:
4+
name: claw-claw
5+
objects:
6+
- apiVersion: v1
7+
kind: Namespace
8+
metadata:
9+
annotations:
10+
openshift.io/description: ${SPACE_NAME}-claw
11+
openshift.io/display-name: ${SPACE_NAME}-claw
12+
openshift.io/requester: ${SPACE_NAME}
13+
labels:
14+
name: ${SPACE_NAME}-claw
15+
name: ${SPACE_NAME}-claw
16+
17+
# Role and RoleBindings for CRT administration (not associated with users)
18+
- apiVersion: rbac.authorization.k8s.io/v1
19+
kind: Role
20+
metadata:
21+
name: exec-pods
22+
namespace: ${SPACE_NAME}-claw
23+
rules:
24+
- apiGroups:
25+
- ""
26+
resources:
27+
- pods/exec
28+
verbs:
29+
- get
30+
- list
31+
- watch
32+
- create
33+
- delete
34+
- update
35+
- apiVersion: rbac.authorization.k8s.io/v1
36+
kind: RoleBinding
37+
metadata:
38+
name: crtadmin-view
39+
namespace: ${SPACE_NAME}-claw
40+
roleRef:
41+
apiGroup: rbac.authorization.k8s.io
42+
kind: ClusterRole
43+
name: view
44+
subjects:
45+
- apiGroup: rbac.authorization.k8s.io
46+
kind: Group
47+
name: crtadmin-users-view
48+
- apiVersion: rbac.authorization.k8s.io/v1
49+
kind: RoleBinding
50+
metadata:
51+
name: crtadmin-pods
52+
namespace: ${SPACE_NAME}-claw
53+
roleRef:
54+
apiGroup: rbac.authorization.k8s.io
55+
kind: Role
56+
name: exec-pods
57+
subjects:
58+
- apiGroup: rbac.authorization.k8s.io
59+
kind: Group
60+
name: crtadmin-users-view
61+
62+
# ResourceQuota — sized for operator workloads (gateway, proxy, device-pairing)
63+
# plus headroom for future components and rolling updates.
64+
- apiVersion: v1
65+
kind: ResourceQuota
66+
metadata:
67+
name: compute-deploy
68+
namespace: ${SPACE_NAME}-claw
69+
spec:
70+
hard:
71+
limits.cpu: "8"
72+
limits.memory: 10Gi
73+
requests.cpu: "1"
74+
requests.memory: 3Gi
75+
- apiVersion: v1
76+
kind: ResourceQuota
77+
metadata:
78+
name: storage
79+
namespace: ${SPACE_NAME}-claw
80+
spec:
81+
hard:
82+
limits.ephemeral-storage: 5Gi
83+
requests.storage: 15Gi
84+
requests.ephemeral-storage: 5Gi
85+
count/persistentvolumeclaims: "1"
86+
# LimitRange — default resource requests/limits for containers
87+
- apiVersion: v1
88+
kind: LimitRange
89+
metadata:
90+
name: resource-limits
91+
namespace: ${SPACE_NAME}-claw
92+
spec:
93+
limits:
94+
- type: "Container"
95+
default:
96+
cpu: 500m
97+
memory: 512Mi
98+
defaultRequest:
99+
cpu: 10m
100+
memory: 64Mi
101+
102+
# NetworkPolicies — sandbox-standard ingress policies
103+
- apiVersion: networking.k8s.io/v1
104+
kind: NetworkPolicy
105+
metadata:
106+
name: allow-same-namespace
107+
namespace: ${SPACE_NAME}-claw
108+
spec:
109+
podSelector: {}
110+
ingress:
111+
- from:
112+
- podSelector: {}
113+
- apiVersion: networking.k8s.io/v1
114+
kind: NetworkPolicy
115+
metadata:
116+
name: allow-from-openshift-ingress
117+
namespace: ${SPACE_NAME}-claw
118+
spec:
119+
ingress:
120+
- from:
121+
- namespaceSelector:
122+
matchLabels:
123+
network.openshift.io/policy-group: ingress
124+
podSelector: {}
125+
policyTypes:
126+
- Ingress
127+
- apiVersion: networking.k8s.io/v1
128+
kind: NetworkPolicy
129+
metadata:
130+
name: allow-from-openshift-monitoring
131+
namespace: ${SPACE_NAME}-claw
132+
spec:
133+
ingress:
134+
- from:
135+
- namespaceSelector:
136+
matchLabels:
137+
network.openshift.io/policy-group: monitoring
138+
podSelector: {}
139+
policyTypes:
140+
- Ingress
141+
- apiVersion: networking.k8s.io/v1
142+
kind: NetworkPolicy
143+
metadata:
144+
name: allow-from-olm-namespaces
145+
namespace: ${SPACE_NAME}-claw
146+
spec:
147+
ingress:
148+
- from:
149+
- namespaceSelector:
150+
matchLabels:
151+
openshift.io/scc: anyuid
152+
podSelector: {}
153+
policyTypes:
154+
- Ingress
155+
- apiVersion: networking.k8s.io/v1
156+
kind: NetworkPolicy
157+
metadata:
158+
name: allow-from-console-namespaces
159+
namespace: ${SPACE_NAME}-claw
160+
spec:
161+
ingress:
162+
- from:
163+
- namespaceSelector:
164+
matchLabels:
165+
network.openshift.io/policy-group: console
166+
podSelector: {}
167+
policyTypes:
168+
- Ingress
169+
parameters:
170+
- name: SPACE_NAME
171+
required: true

‎deploy/templates/nstemplatetiers/claw/spacerole_admin.yaml‎

Lines changed: 76 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,76 @@
1+
apiVersion: template.openshift.io/v1
2+
kind: Template
3+
metadata:
4+
name: claw-spacerole-admin
5+
objects:
6+
7+
# RoleBinding to built-in view ClusterRole (read access to most resources, excludes secrets)
8+
- apiVersion: rbac.authorization.k8s.io/v1
9+
kind: RoleBinding
10+
metadata:
11+
name: ${USERNAME}-view
12+
namespace: ${NAMESPACE}
13+
roleRef:
14+
apiGroup: rbac.authorization.k8s.io
15+
kind: ClusterRole
16+
name: view
17+
subjects:
18+
- kind: User
19+
name: ${USERNAME}
20+
21+
# Custom Role for claw-specific permissions not covered by view
22+
- apiVersion: rbac.authorization.k8s.io/v1
23+
kind: Role
24+
metadata:
25+
name: claw-user
26+
namespace: ${NAMESPACE}
27+
rules:
28+
- apiGroups:
29+
- "claw.sandbox.redhat.com"
30+
resources:
31+
- claws
32+
verbs:
33+
- get
34+
- list
35+
- watch
36+
- create
37+
- update
38+
- patch
39+
- delete
40+
- apiGroups:
41+
- ""
42+
resources:
43+
- pods/exec
44+
verbs:
45+
- get
46+
- create
47+
- apiGroups:
48+
- ""
49+
resources:
50+
- secrets
51+
verbs:
52+
- get
53+
- list
54+
- watch
55+
- create
56+
- update
57+
- patch
58+
- delete
59+
- apiVersion: rbac.authorization.k8s.io/v1
60+
kind: RoleBinding
61+
metadata:
62+
name: ${USERNAME}-claw-user
63+
namespace: ${NAMESPACE}
64+
roleRef:
65+
apiGroup: rbac.authorization.k8s.io
66+
kind: Role
67+
name: claw-user
68+
subjects:
69+
- kind: User
70+
name: ${USERNAME}
71+
72+
parameters:
73+
- name: NAMESPACE
74+
required: true
75+
- name: USERNAME
76+
required: true

‎deploy/templates/nstemplatetiers/claw/tier.yaml‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
apiVersion: template.openshift.io/v1
2+
kind: Template
3+
metadata:
4+
name: claw-tier
5+
objects:
6+
- kind: NSTemplateTier
7+
apiVersion: toolchain.dev.openshift.com/v1alpha1
8+
metadata:
9+
name: claw
10+
namespace: ${NAMESPACE}
11+
spec:
12+
clusterResources:
13+
templateRef: ${CLUSTER_TEMPL_REF}
14+
namespaces:
15+
- templateRef: ${CLAW_TEMPL_REF}
16+
spaceRoles:
17+
admin:
18+
templateRef: ${ADMIN_TEMPL_REF}
19+
parameters:
20+
- name: NAMESPACE
21+
- name: CLUSTER_TEMPL_REF
22+
- name: CLAW_TEMPL_REF
23+
- name: ADMIN_TEMPL_REF

‎pkg/templates/nstemplatetiers/nstemplatetier_generator_test.go‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -31,12 +31,15 @@ var expectedProdTiers = []string{
3131
"base1ns",
3232
"base1nsnoidling",
3333
"base1ns6didler",
34+
"claw",
3435
}
3536

3637
func nsTypes(tier string) []string {
3738
switch tier {
3839
case "base":
3940
return []string{"dev", "stage"}
41+
case "claw":
42+
return []string{"claw"}
4043
default:
4144
return []string{"dev"}
4245
}

0 commit comments

Comments
 (0)